Audit finds 'unacceptable weaknesses' in University of Iowa emergency plans

Officials vow reforms as another deadly school shooting underscores urgency

The Pentacrest on the campus of the University of Iowa including the Old Capitol Building (center), Macbride Hall (top left), Jessup Hall (bottom left), Schaeffer Hall (top right), and MacLean Hall (bottom right) in an aerial photograph in Iowa City on Wednesday, May 14, 2014. (Stephen Mally/The Gazette-KCRG TV9)New University of Iowa Director of Public Safety Scott Beckner speaks to members of the university police force at a staff breakfast at the University of Iowa IMU in Iowa City on Tuesday, Aug. 30, 2016. (Adam Wesley/The Gazette)

IOWA CITY — The University of Iowa’s emergency preparedness — including its ability to handle bomb threats, health crises and hostage situations — has “unacceptable weaknesses” that expose the campus to “unacceptable risks,” a new audit reports.

The report, completed in October and made public last week, found problems with the UI’s emergency policies and plans, its training protocols, its communication strategies and its incident follow-ups.

“Incident and emergency exercise information is not documented fully, completed timely, distributed appropriately, or reviewed for possible improvements,” the report from the UI Office of Internal Audit determined. “The lack of appropriate distribution of emergency information results in delays for corrective actions.”

The audit comes as the nation grapples with another campus shooting — this time at a Florida high school, where a former student shot and killed 17 people.

A day after that mass shooting last week, Iowa lawmakers advanced a bill that would require Iowa K-12 schools establish security plans for their buildings, which some don’t have.

The UI already has experienced an on-campus shooting when on Nov. 1, 1991, graduate student Gang Lu shot and killed five people and paralyzed another before killing himself. He was upset that his dissertation had not won a prize.

Like Iowa State University and the University of Northern Iowa, the UI has a “critical incident management plan.” But the UI plan, the audit found, falls far short of national standards.

ARTICLE CONTINUES BELOW ADVERTISEMENT

“The University of Iowa Department of Public Safety appreciates the fact that the university does internal audits,” public safety Director Scott Beckner said in an email. “This audit will serve as a blueprint to help our department continue to improve our processes and procedures.”

After arriving on campus in July 2016, Beckner said, he and Emergency Management Coordinator Floyd Johnson identified ways to improve.

According to the audit, the university has vowed to update plans and procedures, improve follow-through, clarify staff roles, develop new trainings and technologies and create an “Emergency Management Advisory Committee.”

That group, which has started meeting monthly, will among other things develop an updated comprehensive emergency management plan that complies with national standards and comports with plans at the UI Hospitals and Clinics and other emergency plans.

Although UI officials have reported some progress on issues highlighted by the audit, other changes will take months — with target dates as far out as October 2019.

One issue the UI already has taken some action on relates to its critical incident management plan. According to the audit, the plan doesn’t clearly define emergency management roles or contain “standard elements” aligning with national frameworks. It includes “unique emergency terms and definitions” not used consistently across campus, hurting the UI’s ability to coordinate its emergency plans and resources.

The university has updated aspects of its plan and its operations manual — formally placing Emergency Management Coordinator Johnson in charge of directing and maintaining emergency plans, for example.

Throughout the report, auditors noted areas where the university falls short of federal and national guidelines.

The Federal Emergency Management Agency, for example, requires after-action analyses and reporting that include possible solutions and a plan to train and test those solutions.

The UI audit, which assessed campus emergencies between July 2015 and September 2017, found an after-action report for just one — a fire last June in the Bowen Science Building. At the time of the audit, a follow-up fire assessment remained under development and review.

“No other incident documentation has been generated or distributed,” the audit said.

The university hasn’t developed a multiyear training and mock exercise program, as defined by the Department of Homeland Security, “increasing the risk that emergency responses will not be adequately performed.”

That deficiency means not all members of the UI’s Critical Incident Management Team have completed FEMA training, and UI annual emergency exercises have not consistently included other jurisdictions.

“College and department emergency exercises are voluntary and performed inconsistently,” auditors reported.

Although the Occupational Safety and Health Administration requires employers create and communicate emergency action plans that spell out procedures for emergency evacuation, exit routes and how to account for employees, UI plans “are not consistently created or communicated to faculty, staff, and students.”

The UI, in response to the findings, committed to developing a solution for communicating disaster information “quickly and efficiently.”

Johnson said a new policy has been put in place to ensure the appropriate standards are being followed in regard to alarms on campus.

The university, according to auditors, also vowed to create a standardized process for conducting “after-action reviews” in hopes of learning lessons and identifying gaps in plans and responses by August. And it committed to updating building-specific emergency action plans by July.

The Board of Regents this week is scheduled to discuss the internal audit and campus security at all its public universities.